« Changelog History


OpenSSL v0.9.7.e Release Notes

Release Date: 2005-03-22 // about 19 years ago
    • Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating server and client random values. Previously (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in less random data when sizeof(time_t) > 4 (some 64 bit platforms).

    This change has negligible security impact because:

    1. Server and client random values still have 24 bytes of pseudo random data.

    2. Server and client random values are sent in the clear in the initial handshake.

    3. The master secret is derived using the premaster secret (48 bytes in size for static RSA ciphersuites) as well as client server and random values.

    The OpenSSL team would like to thank the UK NISCC for bringing this issue to our attention.

    Stephen Henson, reported by UK NISCC

    • Use Windows randomness collection on Cygwin.

    Ulf Möller

    • Fix hang in EGD/PRNGD query when communication socket is closed prematurely by EGD/PRNGD.

    Darren Tucker [email protected] via Lutz Jänicke, resolves #1014

    • Prompt for pass phrases when appropriate for PKCS12 input format.

    Steve Henson

    • Back-port of selected performance improvements from development branch, as well as improved support for PowerPC platforms.

    Andy Polyakov

    • Add lots of checks for memory allocation failure, error codes to indicate failure and freeing up memory if a failure occurs.

    Nauticus Networks SSL Team [email protected], Steve Henson

    • Add new -passin argument to dgst.

    Steve Henson

    • Perform some character comparisons of different types in X509_NAME_cmp: this is needed for some certificates that re-encode DNs into UTF8Strings (in violation of RFC3280) and can't or won't issue name rollover certificates.

    Steve Henson

    • Make an explicit check during certificate validation to see that the CA setting in each certificate on the chain is correct. As a side effect always do the following basic checks on extensions, not just when there's an associated purpose to the check:

      • if there is an unhandled critical extension (unless the user has chosen to ignore this fault)
      • if the path length has been exceeded (if one is set at all)
      • that certain extensions fit the associated purpose (if one has been given)

    Richard Levitte